Well, they have a pretty active subreddit at https://www.reddit.com/r/Vanced/ so you can see a few folks besides me championing it.

But ultimately, you can either examine the binary yourself or else trust them.

One point of note is that it does not automatically update. Whether you install it directly or use the manager app, there is always some manual process involved in updates. (The manager just notifies you when there is an update available.)

You can't. It's some closed source blob that may very well become malware, assuming it isn't already. Use NewPipe instead